Connections
Many workflow blocks reach out to another service — Slack, Gmail, Google Sheets, Notion, an AI provider, and so on. Before a block can do that, it needs permission to sign in on your behalf.
A connection is that stored permission. You set it up once in the Connections hub, then pick it from a dropdown inside any block that needs it. Secrets are encrypted at rest and only unlocked while a workflow is running — they are never shown back to you, not even to the person who added them.
The two kinds of connection
| Kind | How you set it up | Shows up under | Typical services |
|---|---|---|---|
| Connected account | You sign in to the service through a popup and approve access | Connected accounts | Google, Microsoft, Atlassian |
| API credential | You paste a key or token the service gave you | API credentials | OpenAI, Slack, Notion, Stripe, Tavily |
Both work the same way once saved: a block just picks the connection by name.
:::info Arketic's own steps need no connection Blocks that stay inside Arketic — knowledge base search, document search, Arketic web search, task create/update, in-app notifications, and the built-in Arketic AI model — work out of the box with nothing to connect. You only need a connection when a block leaves Arketic. :::
Opening the Connections hub
Go to Workflows → Connections.
The hub has four parts, top to bottom:
- A one-line reminder that secrets are encrypted and resolved only at run time.
- Two buttons on the right — Connect account and Add connection.
- A health summary strip that answers "is anything broken?" at a glance.
- Two shelves — Connected accounts and API credentials — each holding one card per connection.
If you haven't set anything up yet you'll see No connections yet, with the message "Connect an account or add an API key so your workflow blocks can reach the services they automate." and both buttons right there.
Each shelf has its own empty hint too:
| Shelf | Hint when it's empty |
|---|---|
| Connected accounts | No connected accounts. Use "Connect account" for OAuth services like Google. |
| API credentials | No API keys yet. Add one for services that authenticate with a key or token. |
Connecting an account (sign-in)
Use this for services where you sign in rather than paste a key.
- Click Connect account.
- Pick the provider from the menu.
- A popup opens on the provider's own sign-in page. Sign in and approve the access it asks for.
- The popup closes and you'll see Account connected. The new account appears on the Connected accounts shelf.
Providers you can sign in with
| Provider | Status |
|---|---|
| Available | |
| Microsoft | Available |
| Atlassian | Available — covers Confluence and Jira |
| Slack | Soon badge — not selectable yet |
| GitHub | Soon badge — not selectable yet |
Providers marked Soon are shown greyed out with a Coming soon tooltip rather than a button that would fail.
:::caution If the popup doesn't open Your browser may be blocking it — you'll see Popup blocked — allow popups and try again. Allow popups for Arketic and click the provider again. If you close the popup without finishing, Arketic simply reports Connection was cancelled. and nothing is saved. :::
If your organisation hasn't finished setting up a particular sign-in provider yet, Arketic tells you plainly instead of failing silently. Ask your administrator to complete the setup, then try again.
Adding an API credential (key or token)
Use this for services that hand you a key or token to paste.
- Click Add connection. The Add a connection gallery opens with the search box already focused.
- Type to narrow it down — the placeholder suggests Search connections… (e.g. Slack, Notion, OpenAI). Search matches the service name.
- Click the service's card.
Each card carries a small label telling you what to expect:
| Card label | What it means |
|---|---|
| Key · testable | Paste a key — Arketic can check it automatically |
| Key | Paste a key — this service offers no automatic check |
| Connect · soon | Sign-in-only service, not available here yet (the card is disabled, with a Connect-only provider — coming soon tooltip) |
:::info Why some services aren't in the gallery The gallery lists the services your workflow blocks can actually use. If you search for something and see No provider matches "…", there is no block for it yet. :::
The New Credential dialog
Picking a service opens New Credential:
| Field | Notes |
|---|---|
| Provider | Pre-filled and hidden when you opened the dialog from a block that already knows its service |
| Name | Required. Your own label for this connection — e.g. My OpenAI key. Up to 200 characters |
| Secret field(s) | One or more fields defined by that service — for example a key, a token, or a key plus an account identifier. Secrets are typed into masked fields |
Click Create (it shows Creating… while it works) or Cancel to back out.
What happens right after Create
- For a testable service, Arketic runs one live check immediately and reports Credential verified — {service}. If the check doesn't come back clean, the connection is still saved and the message tells you the outcome so you can fix it.
- For a service with no automatic check, you simply get Credential created.
Missing fields are flagged inline before anything is saved (for example Name is required).
:::tip Name connections for the job, not just the service You can store more than one credential per service. Marketing HubSpot and Support HubSpot are far easier to pick correctly inside a block than two entries both called HubSpot. :::
Health: knowing what still works
Every connection carries a health chip so you can see at a glance whether a workflow that depends on it will run.
| Chip | What it means | What to do |
|---|---|---|
| Connected | Working | Nothing |
| Invalid | The service rejected the key or token | Re-enter the key, or reconnect the account |
| Action needed | The stored credential has expired | Reconnect to refresh it |
| Not tested | Saved but never checked yet | Run Test now when convenient |
| Can't auto-verify | This service offers no automatic check | Confirm it works by running the workflow |
When something is wrong, the card and the details drawer show a plain-language reason instead of a raw error, such as:
- Key rejected (401) — re-enter it
- Access denied (403) — check the key's permissions
- Key format looks wrong — check for stray spaces
- Expired — reconnect to refresh
- Provider error (5xx) — try testing again
- Authentication failed — re-enter the key
:::info Health is read, not re-tested Opening the Connections tab never fires off live checks against every service. The chips reflect what Arketic already knows. To re-check something on purpose, use Test now on that connection. :::
The health summary strip
Above the shelves, a single line tells you where you stand. When everything is fine it simply reads All … connections healthy. Otherwise it breaks the total down into how many are healthy, how many are not tested, and how many need attention — that last figure is a clickable link.
- Click … need(s) attention → to filter both shelves down to only the broken connections.
- While the filter is on, a Showing needs attention chip appears — click it to go back to everything.
Connections that need attention also sort to the top of their shelf by default, so you never have to hunt for them.
Reading a connection card
Each card on a shelf shows:
- The name you gave it, with the service and the connection type underneath (API key, OAuth account, Bearer token, or Basic auth).
- Its health chip, plus the first couple of access scopes for a signed-in account.
- A last line that depends on the state: Tested 5m ago / Never tested for a key, or Connected / Expires in 3d for an account.
- If something is wrong, the reason and a one-click Reconnect (account) or Re-enter (key) button right on the card.
Hovering an API credential card also reveals a small Test connection button so you can re-check it without opening anything.
Click anywhere else on the card to open its details.
When a shelf gets busy
Once a shelf holds more than a handful of connections, a toolbar appears above it with:
| Control | What it does |
|---|---|
| Search box | Filters that shelf by connection name or service |
| All / Needs attention | Same triage filter as the summary strip |
| Sort | Health (problems first, the default), Recently added, or Name A→Z |
If a filter leaves nothing behind you'll see No connections match your filter.
The connection details drawer
Click a connection to slide out its details panel. Press Esc, click the backdrop, or use the × to close it.
Health
The health chip, the plain-language reason if there is one, and the action that fixes it:
| Connection type | Button | Effect |
|---|---|---|
| API credential | Test now | Runs one live check and reports the result |
| API credential that needs attention | Re-enter key | Reopens the secret fields so you can paste a fresh key |
| Connected account | Reconnect | Reopens the provider sign-in popup |
Underneath sits Last checked, with the date and time of the most recent check.
Test results are reported straight away:
| Outcome | Message |
|---|---|
| Works | Credential is valid. |
| Rejected | Provider rejected the credential. |
| Couldn't tell | Could not verify right now — try again later. |
| No check available | This provider has no test endpoint. |
Identity
A short read-only summary: Provider, Type, expiry (when the service sets one), the date it was Added, and — for signed-in accounts — the Scopes you approved. A footer note repeats the rule: Encrypted at rest, decrypted only at run time. The secret is never shown.
Danger zone
| Button | Confirmation | Result |
|---|---|---|
| Delete credential (API credential) | Delete credential? — warns that blocks referencing it stop authenticating until you pick another | Credential deleted |
| Disconnect account (connected account) | Disconnect account? — warns that blocks using it stop authenticating until you reconnect | Account disconnected |
:::caution Removing a connection is immediate Any workflow whose blocks point at it will fail to authenticate from the next run onward. Repoint those blocks at another connection first if the workflow needs to keep running. :::
Using a connection in a block
Blocks that reach an external service have a credential field — labelled Authentication or Credential depending on the block.
- Open the block's settings (double-click the block, or use Open details in its hover tray).
- Open the credential dropdown. It lists your saved connections for that service by name — the empty prompt reads Select a credential…, or No credentials configured when you have none yet.
- Pick one, and close the block.
Two shortcuts save you a trip:
- For key-based services, an + Add credential link sits under the dropdown. It opens the same New Credential dialog with the service already chosen, and selects the new connection for you as soon as it's created.
- For sign-in-based services, the field instead reminds you: Connect an account under Workflows → Connections — set the account up there first, then come back and pick it.
:::tip Model blocks are the common exception In the Agent, Router and Evaluator blocks the Model dropdown defaults to Arketic AI, which needs no connection at all. You only need a credential there if you switch to an external AI provider's model. :::
When a run stops and asks for a credential
If a workflow starts running and then can't authenticate, the run pauses instead of failing outright. An amber banner in the editor reads Credential required — {service}, with an Update key action for key-based services: re-enter the key inline, then Resume the run and it picks up where it left off. For signed-in accounts, reconnect the account and re-select it on the block.
See Running Workflows for the full run controls.
What you can connect
The gallery covers a wide range of services. These are some of the ones you'll find, grouped by what people usually use them for:
| Group | Services |
|---|---|
| Messaging & email | Slack, Discord, Telegram, WhatsApp, Microsoft Teams, Gmail, Outlook, SMTP, IMAP, Resend, SendGrid, Loops, Twilio, Mailgun, Mailchimp, Postmark |
| Docs & productivity | Notion, Google Sheets, Google Docs, Google Drive, Google Calendar, Google Slides, Google Forms, Google Tasks, Google Contacts, Microsoft Excel, OneDrive, SharePoint, Airtable, Coda, Confluence, Obsidian |
| Development & issue tracking | GitHub, GitLab, Bitbucket, Jira, Jira Service Management, Linear, Asana, ClickUp, Monday, Trello, Azure DevOps, Jenkins, CircleCI, Sentry |
| CRM & sales | HubSpot, Pipedrive, Attio, Salesforce, Intercom, Apollo, Hunter |
| Payments & commerce | Stripe, Shopify, Square |
| AI providers | OpenAI, Anthropic, Perplexity, Mistral, Cohere, HuggingFace, ElevenLabs, Replicate |
| Web search & research | Tavily, Exa, Jina, Firecrawl, Serper, Linkup, Perplexity, DuckDuckGo, Wikipedia, arXiv, Apify |
| Scheduling | Calendly, Cal.com |
| Infrastructure & analytics | Cloudflare, DigitalOcean, PagerDuty, Opsgenie, Datadog, Segment, PostHog, Mixpanel, Amplitude |
The list keeps growing — search the gallery for the service you have in mind.
Good practice
- Give keys the least access they need. Create the key in the other service with only the permissions your workflow uses. If something is later rejected with Access denied (403), that key's permissions are the first place to look.
- Name connections clearly. The block dropdown shows only the name, so the name has to be enough to choose correctly.
- Deal with Action needed before it bites. A scheduled workflow that runs overnight won't ask you to reconnect — it will just fail.
- Test after you rotate a key. When you replace a key in the other service, use Re-enter key here and then Test now, rather than waiting for the next run to find out.
- Prefer Arketic-native blocks where they fit. Knowledge search, task actions and notifications need no keys to maintain at all.
Related pages
- Creating Workflows — build the workflow the connection will serve
- Blocks — which blocks need a connection and what each one does
- Running Workflows — running, pausing and resuming a run
- Logs — step-by-step detail when a run fails
- Workflows Overview — the Workflows tabs at a glance